Create user and grant him search privilege on a specific index with cURL

[flzftw]

Hi guys,

I'm trying to create a user and only grant him search privileges on a specific index using cURL. So far I used these two commands:
Index creation:

curl -k -u admin:password https://SplunkIP:8089/servicesNS/admin/search/data/indexes -d name=mytest

And I found this command example for the user creation:

curl -k -u admin:password https://SplunkIP:8089/services/authentication/users -d name=User1 -d password=changeme -d roles=role

So as far, as I understood, I can directly affect an existing role while creating the User1 account, but I would like to create a specific role which allows him to only read and search from the mytest index.

I found a "createrole" parameter for the last cURL, but it's not clear from the documentation.

So is it possible to create / specify the role while creating a new user? Or is there any other cURL command which can create a role?

Thank you very much !

[paramagurukarth]

Create a role
And Attach your filter to that role...

Check.. [role_<< roleName >>] --> srchFilter in https://docs.splunk.com/Documentation/Splunk/latest/Admin/authorizeconf

or
Give your filter in the field Restrict search terms in UI while creating role

And Assign that role to your User

[somesoni2]

You can create a role for the user but not sure if you can customize the role that way. Better option is to create the role separately (before creating user) with all the customization (index access) and then assign that role to the user while creating (or update if already created). See this link for roles creation curl using Splunk REST API

http://docs.splunk.com/Documentation/Splunk/6.2.6/RESTREF/RESTaccessExamples#authorization.2Froles_P...